Keplr just switched off "Sign in with Google." Turns out the login was holding the keys.
Web3Auth, the provider behind Keplr's Google and Apple sign-in, paused its embedded wallet service Friday over a "security issue." About seven hours later, Keplr reported unauthorized transactions on some social-login accounts and paused those logins.
Founder Josh Lee's early estimate: roughly 20% of social-login wallets affected, only a fraction actually drained, the rest possibly recoverable. Recovery-phrase and hardware-wallet accounts look unaffected so far. If you signed up with Google or Apple: don't send new funds, don't re-import the account elsewhere, and ignore anyone offering a "recovery" link.
One-click onboarding. Multi-party offboarding.